Malaysia PDPA amendments: DPO and breach notification

Since 1 June 2025, Malaysian controllers and processors must appoint a DPO and report breaches.

What you need to know

• 1 Apr 2025: processors bound by the Security Principle; biometric data is sensitive; higher penalties; whitelist for transfers removed.
• 1 Jun 2025: appoint at least one DPO (controllers and processors) and notify the Commissioner.
• 1 Jun 2025: notify the Commissioner of a breach as soon as practicable (guidance proposed 72 hours); tell affected people if significant harm is likely.
• Keep a list of systems, including AI tools, that hold personal data - you need it to assess a breach fast.

First step: list your AI systems and the data they use

Every one of these laws is easier with a written inventory. Our free AI register template gives you one in minutes.

Get the free register

Free edition. Paid plans are optional. Built originally for the EU AI Act; the Southeast Asia mapping is in this guide, not yet inside the app.

Official sources

• https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/10/Act-A1727.pdf
• https://www.rajahtannasia.com/viewpoints/dates-of-coming-into-operation-of-the-personal-data-protection-amendment-act-2024/
• https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2025/08/JPDP-FSB-190824-DBN-PCP-ENG-TC.pdf

Checked 13 Oct 2026. General information, not legal advice. Team Unadhi.